Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for wh

Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for which processing will take place to be individually enumerated and consented * granularity: the ability to opt-out (default) to each processing purpose There's no ban on including a button that opts a user in to everything, but you would have to take care to make it very difficult to click by accident or I can possibly see a regulator permitting this. See eg discussion of "clear affirmative action" (A32). And I think the eu will very specifically place the highest scrutiny on google and facebook, rather than the least. edit: no doubt, some smart-asses are going to push their luck, but they'll get slapped down in short order (imo). The GDPR regulators will be looking to make an example of some companies. Also, the stick here is the larger of 10m euro or 4% of global turnover.